About

I engineer backend systems, study low-level systems, and research API security vulnerabilities. My focus is authorisation and access control: how an API decides who can read or change each piece of data.

I’m Luqman Shaban, a developer from Kenya. I’ve been coding since 2022 and have built and launched Pingstat and Verisite. Pingstat monitors websites and API responses. Verisite checks website security headers and produces a short report. I’m also studying Computer Science at the University of the People.

I’m learning the whole API lifecycle, from HTTP and databases to authentication, reliability, and security testing. I want to understand how a system is built and operated before investigating how it can fail. My current security focus includes ownership checks and the boundaries between ordinary users and administrators.

I use AI coding tools for boilerplate. I keep control of decisions around authentication, authorisation, data access, and concurrency. Those are the parts I want to understand well enough to question and verify.

This site is where I document that work. I’m early in this specialisation, and I write as I learn. The aim is to make each write-up useful to another builder, with enough detail for them to follow the reasoning and understand its limits.